The Grav Flex Objects plugin contains an authorization bypass in its generic /api/v1/flex-objects/pages API routes. The service checks only directory-level admin.pages permissions and fails to enforce the API's api.pages.read/write permissions or page‑level rules. As a result, authenticated non‑super users with api.access or admin.pages or admin.configuration.pages permissions can read page source, modify content, or delete pages that should be protected, compromising data confidentiality, integrity, and availability for those pages.

Versions of the Grav Flex Objects plugin from 1.4.0 up to, but not including, 1.4.17 are affected. The plugin is provided by the getgrav organization. Anyone who has installed one of these versions and relies on the /api/v1/flex-objects/pages endpoints is at risk.

The CVSS score of 7.1 indicates a high severity vulnerability. No publicly known exploitation has been reported, and the issue is not listed in the CISA KEV catalog, suggesting no active exploitation at this time. Based on the description, the likely attack vector is network‑based: an attacker authenticates as a non‑super user and performs API calls to the vulnerable endpoints. Because generic admin.pages permissions are insufficient to prevent the bypass, an attacker with these permissions can effectively gain elevated authority over protected pages.